Age	Commit message (Collapse)	Author	Lines
5 days	Say which trailers the shipped filter links	Bryce Kwon	-2/+3
	link-trailers.lua has shipped its Closes and Bug rules commented out since b4e780a, as they need a tracker address, but both docs still promised those links.
5 days	Say to run the cache hook as the web server	Bryce Kwon	-4/+8
	The header asked for write access for the pushing user, but MANUAL.txt keeps the cache root at mode 0700 for the web server and cgit writes its slots at 0600, so a pusher could at best drop every page rather than only its own.
6 days	Suggest a Markdown file for root-readme	Bryce Kwon	-3/+4
6 days	Warn that a repository listed twice shows twice	Bryce Kwon	-0/+2
6 days	Say strict-export applies only to a scan	Bryce Kwon	-1/+1
6 days	State once that cgitrc is read in order	Bryce Kwon	-0/+4
	The rule was written down only under scan-path, so a setting such as enable-blame=1 added at the end of cgitrc silently did nothing.
6 days	List a theme after cgit.css	Bryce Kwon	-3/+5
	Any css or js line replaces the default rather than adding to it, so a theme set with a single css line, as the README implied, left every page unstyled.
7 days	Point the install notes at distribution packages	Bryce Kwon	-72/+81
	Debian, Ubuntu, Fedora and Alpine package luaossl, luaposix and lpeg for the Lua versions they ship, which leaves LuaRocks for the rest. Scintillua comes as a release zip whose lexers directory is what the filter looks for, so its steps say where to put that.
7 days	Name a missing Lua module in the error log	Bryce Kwon	-5/+22
7 days	Log failed logins	Bryce Kwon	-0/+14
	The login posts outside any repository, so the log line names the repository by the page its signed way back leads to.
7 days	Say that logging in needs https	Bryce Kwon	-4/+18
	Only HTTPS=on counts, the same test cgit makes before it writes an https link of its own.
7 days	Tell a signed-in visitor they have no access	Bryce Kwon	-0/+12
7 days	Say when logins are unavailable	Bryce Kwon	-12/+38
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
7 days	Keep counting across a split ordered list	Bryce Kwon	-1/+8
8 days	Say the auth filters match a repository's url	Bryce Kwon	-13/+22
	A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public.
8 days	Say where an edited auth filter belongs	Bryce Kwon	-2/+17
	make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user.
9 days	Find a capitalised extension's lexer again	Bryce Kwon	-2/+4
	Scintillua's detect() matches an extension by its case, and the fallback e227d1f dropped had lowercased it, so MAIN.C and SETUP.PY lost their colour. The fake lexer now answers only for the suffixes it knows, as Scintillua does, which is what lets the check see it.
9 days	Describe a negative section-from-path in cgitrc	Bryce Kwon	-2/+3
9 days	Spell url in the Lua comments as the docs do	Bryce Kwon	-16/+16
9 days	Say cgit pages carry no expiry, not no headers	Bryce Kwon	-3/+3
	Behind an auth filter every page carries Cache-Control: private and the login page no-store, so only the missing expiry holds on every site.
9 days	Correct two fallbacks the sample config states	Bryce Kwon	-3/+3
	cgit_snapshot_prefix falls back to the basename of the repository url, and print_object sends a binary blob as application/octet-stream.
9 days	Name the pages the highlighter runs on	Bryce Kwon	-1/+1
9 days	Point the source-filter sample at its notes	Bryce Kwon	-3/+2
9 days	Write five compound terms one way in the docs	Bryce Kwon	-2/+2
	Each takes the form its option name or most of the prose already uses, as in case-sensitive-sort and side-by-side-diffs.
9 days	Spell HTML in capitals as most of the docs do	Bryce Kwon	-1/+1
	The head section loses its capitals too, since HEAD elsewhere in the manual is git's.
9 days	Spell url the way the tree mostly does	Bryce Kwon	-14/+14
	Names keep their own spelling, so the URL trailer and CGIT_REPO_URL stay in capitals.
10 days	Spell non-zero the way the tree does	Bryce Kwon	-3/+3
10 days	Say the highlighter needs Scintillua's detect()	Bryce Kwon	-1/+2
10 days	Catch a lexer's failure in one place	Bryce Kwon	-12/+9
	filter_close already runs highlight under pcall and serves the escaped text when it fails, so the pcalls around detect, load and lex inside it only turned a raise into the same fallback a step earlier.
10 days	Write a session's expiry in whole seconds	Bryce Kwon	-0/+10
	On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it.
10 days	Collect an email filter's writes like the others	Bryce Kwon	-10/+12
10 days	Say what really differs between the auth filters	Bryce Kwon	-6/+8
	The lookups were never the only difference, since the configuration and trim's place differ as well. The configuration is now set off by blank lines, as in the other extensions, instead of a heading.
10 days	Drop auth guards for input cgit never sends	Bryce Kwon	-18/+6
	cgit passes an empty string, never nil, when a request names no repository, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
10 days	Strip control characters from the location alone	Bryce Kwon	-18/+12
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
10 days	Drop the URL helpers' guards that cannot fire	Bryce Kwon	-18/+2
	Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way.
10 days	Keep only the request fields the auth filters read	Bryce Kwon	-42/+10
	Seven of the twelve fields filter_open stored were never read. Naming all twelve parameters keeps the order cgit passes them in on record.
10 days	Take a signed cookie apart with one match	Bryce Kwon	-82/+10
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
10 days	Drop the highlighter's extension fallback	Bryce Kwon	-47/+8
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.
10 days	Call string.match like the rest of the highlighter	Bryce Kwon	-1/+1
10 days	Carry a man page's text as plain strings	Bryce Kwon	-23/+16
	lpeg's constant, query and numbered captures already do what the token helpers did, and nothing ever read the tokens of an escape that draws nothing.
10 days	Take a no fill line's plain text from its nodes	Bryce Kwon	-7/+1
10 days	Wrap a man page's font runs as the macros do	Bryce Kwon	-27/+11
10 days	Reuse the digit pattern where it is spelt out	Bryce Kwon	-2/+2
10 days	Build the block start test from the line grammars	Bryce Kwon	-2/+1
10 days	Count a rule among the blocks that end a paragraph	Bryce Kwon	-7/+4
10 days	Inline the list check before indented code	Bryce Kwon	-6/+2
10 days	Read a setext heading's level off its capture	Bryce Kwon	-10/+4
10 days	Build every code block in one place	Bryce Kwon	-17/+11
10 days	Replace a readme's NUL bytes in one substitution	Bryce Kwon	-19/+3
10 days	Let the dispatch serve markdown without lpeg	Bryce Kwon	-5/+0
	Without lpeg both renderers stay nil, and the handler lookup already falls back to plain text for a format it has no renderer for.